Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ACL] Suppoprt add rule incrementally for data plan rules #1776

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ezio-chen
Copy link

What I did

  • Fix "config acl update increment" command to add rule incrementally.
  • Fix acl_loader can't add source-ip or destination-ip with IP prefix is not 32

How I did it

Do not delete all existed rules for data plan rules, just add the new rules to configDB.

How to verify it

Verify on broadcom platform

  1. Add ACL table L3_TABLE
  admin@sonic:~$ sudo config acl add table L3_TABLE L3 -p Ethernet0
  1. Add rule.json
  admin@sonic:~$ sudo config acl update incremental rule.json
  # rule.json
  {
    "acl": {
      "acl-sets": {
        "acl-set": {
          "L3_TABLE": {
            "acl-entries": {
              "acl-entry": {
                "1": {
                  "actions": {
                    "config": {
                      "forwarding-action": "DROP"
                    }
                  },
                  "config": {
                    "sequence-id": 1
                  },
                  "ip": {
                    "config": {
                      "source-ip-address": "10.0.0.1/16",
                      "destination-ip-address": "10.0.0.2/32"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  1. Update rule increment with rule2.json
  admin@sonic:~$
  # rule2.json
  {
    "acl": {
      "acl-sets": {
        "acl-set": {
          "L3_TABLE": {
            "acl-entries": {
              "acl-entry": {
                "2": {
                  "actions": {
                    "config": {
                      "forwarding-action": "ACCEPT"
                    }
                  },
                  "config": {
                    "sequence-id": 2
                  },
                  "ip": {
                    "config": {
                      "source-ip-address": "10.0.0.3/16",
                      "destination-ip-address": "10.0.0.4/32"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  1. Verify rules
  admin@sonic:~$ aclshow -a
  RULE NAME     TABLE NAME      PRIO    PACKETS COUNT    BYTES COUNT
  ------------  ------------  ------  ---------------  -------------
  RULE_1        L3_TABLE        9999                0              0
  RULE_2        L3_TABLE        9998                0              0
  DEFAULT_RULE  L3_TABLE           1                0              0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant